registry  /  xei-editor  /  0.1.0

xei-editor@0.1.0

xei (晴) — a modern Vim-like terminal editor in Rust

AI Security Review

scanned 8h ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package ships a native terminal editor and has an install hook that fills a missing package-local binary from the project's GitHub release.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall when bin/xei is missing; user runs xei for editor behavior
Impact
Installs or executes an editor binary; runtime file edits/deletes and terminal are documented user actions.
Mechanism
package-local binary install/download and user-invoked terminal editor
Rationale
The suspicious primitives are package-aligned for distributing a native CLI editor and are either package-local at install time or documented user-invoked editor features. No concrete evidence shows exfiltration, persistence, destructive install behavior, or AI-agent control hijack.
Evidence
package.jsoninstall.jsbin/xeiREADME.md~/.xei.toml
Network endpoints2
github.com/stremtec/xei/releases/download/v0.1.0/xei-${target}.gzgit+https://github.com/stremtec/xei.git

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js
  • install.js can download a gzip binary from GitHub releases if bin/xei is absent
  • bin/xei is a native Mach-O executable
Evidence against
  • install.js only targets package-local bin/xei and chmods it
  • install.js uses fixed package-aligned URL https://github.com/stremtec/xei/releases/download/v0.1.0/xei-${target}.gz
  • bin/xei strings align with a terminal editor: ratatui/crossterm, syntax keywords, /usr/bin/script, xei.toml
  • No source evidence of credential harvesting, exfiltration, persistence, AI-agent control-surface writes, or shell startup/VCS hook mutation
  • README documents editor file operations, built-in terminal, and ~/.xei.toml config as user-invoked runtime behavior
Behavioral surface
Source
FilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.63 KB of source, external domains: github.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/xeiView file
•path = bin/xei kind = native_binary sizeBytes = 989520 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/xeiView on unpkg

Findings

1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Native Binarybin/xei
LowScripts Present
LowFilesystem
LowUrl Strings